diff options
author | Antonino A. Daplas <adaplas@gmail.com> | 2007-05-31 02:04:57 -0400 |
---|---|---|
committer | Linus Torvalds <torvalds@woody.linux-foundation.org> | 2007-05-31 10:48:27 -0400 |
commit | a2b7d2e97edcad0e95ae0d3c253d3f2f69254fa4 (patch) | |
tree | 26b392f8aa430a2715f40f54290952ea1e070436 | |
parent | 3f0a6766e0cc5a577805732e5adb50a585c58175 (diff) |
neofb: Fix pseudo_palette array overrun in neofb_setcolreg
The pseudo_palette has room for 16 entries only, but in truecolor mode, it
attempts to write 256.
Signed-off-by: Antonino Daplas <adaplas@gmail.com>
Acked-by: Tero Roponen <teanropo@jyu.fi>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
-rw-r--r-- | drivers/video/neofb.c | 30 |
1 files changed, 16 insertions, 14 deletions
diff --git a/drivers/video/neofb.c b/drivers/video/neofb.c index bd30aba242d..731d7a5c5aa 100644 --- a/drivers/video/neofb.c +++ b/drivers/video/neofb.c | |||
@@ -1286,34 +1286,36 @@ static int neofb_setcolreg(u_int regno, u_int red, u_int green, u_int blue, | |||
1286 | if (regno >= fb->cmap.len || regno > 255) | 1286 | if (regno >= fb->cmap.len || regno > 255) |
1287 | return -EINVAL; | 1287 | return -EINVAL; |
1288 | 1288 | ||
1289 | switch (fb->var.bits_per_pixel) { | 1289 | if (fb->var.bits_per_pixel <= 8) { |
1290 | case 8: | ||
1291 | outb(regno, 0x3c8); | 1290 | outb(regno, 0x3c8); |
1292 | 1291 | ||
1293 | outb(red >> 10, 0x3c9); | 1292 | outb(red >> 10, 0x3c9); |
1294 | outb(green >> 10, 0x3c9); | 1293 | outb(green >> 10, 0x3c9); |
1295 | outb(blue >> 10, 0x3c9); | 1294 | outb(blue >> 10, 0x3c9); |
1296 | break; | 1295 | } else if (regno < 16) { |
1297 | case 16: | 1296 | switch (fb->var.bits_per_pixel) { |
1298 | ((u32 *) fb->pseudo_palette)[regno] = | 1297 | case 16: |
1298 | ((u32 *) fb->pseudo_palette)[regno] = | ||
1299 | ((red & 0xf800)) | ((green & 0xfc00) >> 5) | | 1299 | ((red & 0xf800)) | ((green & 0xfc00) >> 5) | |
1300 | ((blue & 0xf800) >> 11); | 1300 | ((blue & 0xf800) >> 11); |
1301 | break; | 1301 | break; |
1302 | case 24: | 1302 | case 24: |
1303 | ((u32 *) fb->pseudo_palette)[regno] = | 1303 | ((u32 *) fb->pseudo_palette)[regno] = |
1304 | ((red & 0xff00) << 8) | ((green & 0xff00)) | | 1304 | ((red & 0xff00) << 8) | ((green & 0xff00)) | |
1305 | ((blue & 0xff00) >> 8); | 1305 | ((blue & 0xff00) >> 8); |
1306 | break; | 1306 | break; |
1307 | #ifdef NO_32BIT_SUPPORT_YET | 1307 | #ifdef NO_32BIT_SUPPORT_YET |
1308 | case 32: | 1308 | case 32: |
1309 | ((u32 *) fb->pseudo_palette)[regno] = | 1309 | ((u32 *) fb->pseudo_palette)[regno] = |
1310 | ((transp & 0xff00) << 16) | ((red & 0xff00) << 8) | | 1310 | ((transp & 0xff00) << 16) | ((red & 0xff00) << 8) | |
1311 | ((green & 0xff00)) | ((blue & 0xff00) >> 8); | 1311 | ((green & 0xff00)) | ((blue & 0xff00) >> 8); |
1312 | break; | 1312 | break; |
1313 | #endif | 1313 | #endif |
1314 | default: | 1314 | default: |
1315 | return 1; | 1315 | return 1; |
1316 | } | ||
1316 | } | 1317 | } |
1318 | |||
1317 | return 0; | 1319 | return 0; |
1318 | } | 1320 | } |
1319 | 1321 | ||